SO
Vendor
Socket
16
CVEs
0
On KEV
0
New 30D
Products
EN7.5
Engine.io
Socket
6 CVEs0 on KEV0 new
SO9.8
Socket.io-parser
Socket
4 CVEs0 on KEV0 new
SO7.5
Socket.io
Socket
3 CVEs0 on KEV0 new
EN5.9
Engine.io-client
Socket
1 CVEs0 on KEV0 new
SF8.1
Socket Firewall
Socket
1 CVEs0 on KEV0 new
SJ7.5
Socket.io-client Java
Socket
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90651 | SF Socket Firewall Socket | 8.1 | Sep 12 | Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default |
| CVE-2026-59725 | EN Engine.io Socket | 7.5 | Jul 8 | Socket.IO: Engine.IO Polling Transport Connection Exhaustion |
| CVE-2026-59724 | EN Engine.io Socket | 7.5 | Jul 8 | Socket.IO: Engine.IO WebTransport SID DoS |
| CVE-2026-33151 | SO Socket.io-parser Socket | 7.5 | Mar 20 | socket.io allows an unbounded number of binary attachments |
| CVE-2024-38355 | SO Socket.io Socket | 7.3 | Jun 19 | Unhandled 'error' event in socket.io |
| CVE-2023-32695 | SO Socket.io-parser Socket | 7.5 | May 27 | Insufficient validation when decoding a Socket.IO packet |
| CVE-2023-31125 | EN Engine.io Socket | 6.5 | May 8 | Uncaught exception in engine.io |
| CVE-2022-41940 | EN Engine.io Socket | 6.5 | Nov 22 | Uncaught exception in engine.io |
| CVE-2022-2421 | SO Socket.io-parser Socket | 9.8 | Oct 25 | Socket.io - Improper type validation in attachment parsing |
| CVE-2022-25867 | SJ Socket.io-client Java Socket | 7.5 | Aug 2 | NULL Pointer Dereference |
| CVE-2022-21676 | EN Engine.io Socket | 7.5 | Jan 12 | Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO |
| CVE-2020-28481 | SO Socket.io Socket | 4.3 | Jan 19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration |
| CVE-2020-36049 | SO Socket.io-parser Socket | 7.5 | Jan 8 | socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used |
| CVE-2020-36048 | EN Engine.io Socket | 7.5 | Jan 8 | Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport |
| CVE-2017-16031 | SO Socket.io Socket | 7.5 | Jun 4 | Socket.io is a realtime application framework that provides communication via websockets |
| CVE-2016-10536 | EN Engine.io-client Socket | 5.9 | May 31 | engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO |